A Partner Just Caught Staff Pasting Client Data Into a Free Chatbot. What Governance Do We Write First?

Someone on staff pasted a tax return, a trial balance, or a client memo into a free chatbot because it felt faster than the old checklist. A partner found out. Panic is optional. A written rule is not. Here is what to lock down first so the firm can use AI without treating every chat window like a filing cabinet.

A partner just caught staff pasting client data into a free chatbot. What governance do we write first?

Write a one-page AI use policy that names approved tools, bans client-identifying data in consumer chatbots, requires disclosure on client work product, and assigns a partner owner for exceptions. Training decks and tool demos can wait one day. The first artifact is the rule staff can quote when the next deadline hits. If you came here asking what to write after a client-data paste incident, that policy page is the whole first move.

Keep the language plain. "Do not paste client names, SSNs, return PDFs, or unpublished financials into free consumer AI tools." "Only use firm-approved accounts." "Any AI-assisted client deliverable needs a human reviewer named on the file." Vague slogans like "use AI responsibly" do not survive busy season.

What belongs on the one-page AI use policy before we buy another seat?

Approved tools, banned data classes, review requirements, client disclosure expectations, logging rules, and the partner who owns exceptions. That is enough to stop the bleeding. Expand later into department playbooks. Practical first page:

• Approved tools and account types (firm tenant only, not personal free accounts).
• Banned inputs: client identifiers, return images, bank details, health data, passwords.
• Allowed uses: drafting with anonymized facts, research with public sources, internal checklists.
• Review gate: named reviewer before anything leaves the firm.
• Exception path: who can approve a one-off and for how long.

If your bigger gap is which operating jobs AI should own after the policy exists, soft-start with Hire the Machine ($49). That is a sibling process for job selection. Both CTAs in this post stay on The AI-Ready Firm.

Want the complete system? Partner governance decisions, adoption sequencing, and the field manual for AI in an accounting practice are in The AI-Ready Firm: A Partner's Governance and Adoption Playbook for AI in an Accounting Practice. → Get The AI-Ready Firm ($99)

How do we inventory what staff already connected without shaming people?

Run a 48-hour amnesty register: tool name, who uses it, what data it can see, and whether it is approved, then disconnect anything that fails the new policy. People hide what they fear will get them yelled at. An amnesty window with a clear deadline produces a cleaner list. Put the register in a shared sheet the managing partner can read in five minutes. Idle personal accounts with client data access are pure risk.

Do not turn the register into a prosecution file. Turn it into a retirement list and an approval list. Keep firm-approved tools. Kill personal free accounts that touched client work. Schedule a quarterly re-check the same way you re-check other firm systems.

What does a 30-day firm adoption plan look like after the policy is signed?

Week 1 policy and register, week 2 approved-tool onboarding, week 3 one supervised pilot per team, week 4 partner review of incidents and edits. Adoption without governance is how you get another paste incident. Governance without a pilot is how the policy becomes shelfware. Pair them. Measure whether drafts needed heavy rewrite and whether any banned data almost entered a chat. Adjust the policy from evidence, not from vendor emails.

For a non-client gift while partners debate the policy draft, the storefront also offers an 11 by 11 inch raised city map for office decor. Soft link only. The hero remains governance.

Want the full partner playbook for AI governance in the firm?

If you want the partner-ready governance and adoption system for AI in an accounting practice, get The AI-Ready Firm. One-time digital download from DC Additive Pros. Educational process, not legal or ethics advice. Verify against your state board, insurer, and client agreements before you act.

→ Get The AI-Ready Firm ($99)

Frequently asked questions

What should a firm write first after staff paste client data into ChatGPT?
A one-page AI use policy that bans client-identifying data in consumer chatbots, names approved tools, requires human review, and assigns a partner for exceptions.

Is The AI-Ready Firm legal advice for CPA firms?
No. It is an educational governance and adoption playbook. It is not legal, ethics, or regulatory advice. Verify against your state board, firm counsel, and client agreements.

Do we need to ban all AI after an incident?
Not necessarily. Many firms keep approved tools with firm accounts and ban personal free accounts for client work. Write the rule, inventory what exists, then decide.

How is this different from Hire the Machine?
Hire the Machine helps owners pick the first AI job. The AI-Ready Firm is the partner governance and adoption system for professional-services firms. Soft-link Hire the Machine when job selection is the sibling gap.